feat(pi): add update PR mode

[BillLeoutsakosvl346]

Stacked PR

This PR is stacked on #5962 and intentionally targets feature/pi-babysit. PR #5962 remains unchanged and targets staging.

Do not merge this PR before #5962. After #5962 merges, this branch will be rebased onto the merged Babysit tree on staging, retargeted to staging, and revalidated.

Summary

Add Update PR (cloud_branch) as the fourth Pi mode, with Create PR permission and Babysit parity.

• Check out one exact existing remote branch and push HEAD back with a normal non-force refspec.
• Find the exact open same-repository PR for that branch; update it when found and create it when missing.
• Reuse Base Branch, PR Title, PR Body, and a tri-state PR State control (preserve, draft, ready). Blank metadata preserves an existing PR and is generated for a new PR.
• Reuse Create PR memory, skills, search, BYOK, streaming, authoring, Babysit, budgets, outputs, and GitHub permission model.
• Complete the initial non-force push before any PR mutation. A rejected push prevents PR changes and Babysit; a no-change run still creates or updates the PR.
• With Babysit, ensure the PR is ready, create it if missing, and feed its number into the existing continuation.
• Fail closed on ambiguous, forked, closed, moved, or mismatched PRs. Never merge, rebase, retry, or force-push at runtime.

Security Boundaries

• The GitHub token is used only by host GitHub operations and sandbox clone/push commands; it is absent from Pi and commit/diff preparation.
• Model and optional search keys are scoped to Pi and absent from clone, commit/diff preparation, push, and host PR operations.
• PR coordinates are validated before and after authoring, and surfaced text/errors are scrubbed against all sandbox credentials.
• Existing Babysit pinning, reviewer trust, budgets, and lifetime limits are reused unchanged.

Permissions

Create PR and Update PR require the same GitHub permissions:

• Fine-grained token: Contents: Read and write and Pull requests: Read and write.
• Classic token: repo scope, with organization SSO authorization when required.
• Babysit additionally needs the existing issue-comment, review-thread, Actions, commit-status, and check reads/writes documented for Create PR.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other

Testing

• All Pi suites: 20 files / 293 tests passed before the final two focused regression additions; the final focused suites pass 67 tests.
• Sim TypeScript type-check passed.
• Biome passed for all touched TypeScript files.
• Fumadocs MDX generation passed.
• Monorepo boundary and API validation audits passed.

Review focus: exact PR discovery/revalidation, push-before-PR sequencing, missing-PR creation, metadata/draft transitions, no-op finalization, non-fast-forward failure, Babysit reuse, and credential isolation.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement

Screenshots/Videos

Not included: this is a cloud-gated block option and behavior is covered by block visibility and handler/backend tests.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 29, 2026 4:12am

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

cursor review

[cursor]

PR Summary

Medium Risk
New GitHub write paths (branch push, PR create/update, draft state) and sandbox credential handling extend an already sensitive area, but behavior is fail-closed with heavy test coverage and unchanged Babysit pinning model.

Overview
Adds Update PR (cloud_branch) as a fourth Pi Coding Agent mode: sandbox checkout of an existing remote branch, non-force push, then create or update the matching same-repo PR (with optional Babysit parity with Create PR).

The block gains Target Branch, PR State (preserve / draft / ready), and shared authoring fields (Base Branch, title/body, Babysit, skills, memory). Create PR and Update PR both require BYOK; cloud authoring is refactored through shared runCloudAuthoringPi / runCloudBranchPi.

Host-side GitHub logic adds exact open-PR discovery for a branch (findOpenPrForBranch), revalidation after authoring, GraphQL draft/ready transitions, and push-before-PR-mutation (failed push blocks PR updates and Babysit; no-op runs can still open/update a PR). Standalone babysit mode is rejected in favor of Babysit on Create/Update PR.

Docs and tests cover the new mode, visibility, and edge cases (ambiguous PRs, non-fast-forward, duplicate PR avoidance).

^{Reviewed by Cursor Bugbot for commit 5aaf5fd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Adds Update PR (cloud_branch) as a fourth Pi mode with Create PR–parity authoring, PR create/update, and optional Babysit.

• Block UI/docs: target branch, tri-state PR State, shared Babysit/skills/memory, cloud visibility.
• Handler/backend: checkout existing branch, non-force push before PR mutation, exact open same-repo PR discovery, create-when-missing, draft/ready transitions, credential scrubbing.
• Tests cover surface, discovery/revalidation, push-before-PR, no-op finalization, and Babysit wiring.

Confidence Score: 5/5

This follow-up pass found no remaining blocking failures and the PR appears safe to merge from the available review context.

No blocking failure remains; no prior Greptile threads were available to re-validate, and no new follow-up-eligible findings were established.

Important Files Changed

Filename	Overview
apps/sim/executor/handlers/pi/cloud-backend.ts	Shared cloud authoring path for Create/Update PR with push-before-PR, ensureUpdatePullRequest, and Babysit combine.
apps/sim/executor/handlers/pi/github-pr.ts	Exact open same-repo PR lookup/revalidation and GraphQL draft/ready state changes.
apps/sim/executor/handlers/pi/pi-handler.ts	Parses cloud_branch inputs (targetBranch, prState, babysit) and dispatches runCloudBranchPi.
apps/sim/blocks/blocks/pi.ts	Adds Update PR mode option, targetBranch/prState fields, and CLOUD_AUTHORING conditions for shared controls.
apps/docs/content/docs/en/workflows/blocks/pi.mdx	Documents Update PR behavior, permissions, fields, and Babysit parity with Create PR.

_{Reviews (12): Last reviewed commit: "fix(pi): follow replacement update PRs" | Re-trigger Greptile}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0fc8bd1. Configure here.}

[BillLeoutsakosvl346]

Demo:

Screen.Recording.2026-07-28.at.5.26.08.PM.mov

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

cursor review

[BillLeoutsakosvl346]

@greptileai

[BillLeoutsakosvl346]

cursor review

[BillLeoutsakosvl346]

@greptileai

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5aaf5fd. Configure here.}